GHSA-8qmr-c66f-g368: Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data

Q: Which deployments are exposed to this issue?

A deployment is affected only if it installs and uses the optional mmpstrucdata plugin and an incoming RFC5424 message can reach an action that uses it. The effective MaxMessageSize must also permit a structured-data parameter large enough to exceed the plugin's 32 KiB stack buffer.

Q: What does an attacker need to exploit it?

An attacker does not need authentication or user interaction, but must be able to send a crafted RFC5424 log message to the affected processing path. The message must contain an oversized structured-data parameter and must not be rejected by the configured message-size limit.

Q: What is the known impact?

The demonstrated result is a crash that interrupts log collection through an attacker-controlled stack overwrite. Code execution has not been demonstrated.

Q: What can be done before upgrading?

If upgrading is not immediately possible, remove or stop using the mmpstrucdata plugin for processing untrusted messages, or enforce an effective MaxMessageSize below the size needed to overflow the 32 KiB parameter buffer. Ensure untrusted RFC5424 messages cannot reach actions using the plugin.

Q: How can I determine whether my configuration is affected?

Review the active Rsyslog configuration to determine whether mmpstrucdata is installed and used by any action that processes inbound RFC5424 messages. Also check the effective MaxMessageSize for that path; deployments with limits below the required oversized parameter threshold are not affected.

Published Sep 18, 2026

Updated

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSDPARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 1024] stack buffer and calls parsePARAMVALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.

Affected Software

1 affected component

rsyslog Rsyslog>=7.5.4<8.2606.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rsyslog to a version that resolves this vulnerability.
Fixed in 8.2606.0

Event History

Sep 18, 2026

CVE Published

via OSV·04:54 PM

Data Sourced

via OSV·04:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

A deployment is affected only if it installs and uses the optional mmpstrucdata plugin and an incoming RFC5424 message can reach an action that uses it. The effective MaxMessageSize must also permit a structured-data parameter large enough to exceed the plugin's 32 KiB stack buffer.

What does an attacker need to exploit it?

An attacker does not need authentication or user interaction, but must be able to send a crafted RFC5424 log message to the affected processing path. The message must contain an oversized structured-data parameter and must not be rejected by the configured message-size limit.

What is the known impact?

The demonstrated result is a crash that interrupts log collection through an attacker-controlled stack overwrite. Code execution has not been demonstrated.

What can be done before upgrading?

If upgrading is not immediately possible, remove or stop using the mmpstrucdata plugin for processing untrusted messages, or enforce an effective MaxMessageSize below the size needed to overflow the 32 KiB parameter buffer. Ensure untrusted RFC5424 messages cannot reach actions using the plugin.

How can I determine whether my configuration is affected?

Review the active Rsyslog configuration to determine whether mmpstrucdata is installed and used by any action that processes inbound RFC5424 messages. Also check the effective MaxMessageSize for that path; deployments with limits below the required oversized parameter threshold are not affected.

GHSA-8qmr-c66f-g368: Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the known impact?

What can be done before upgrading?

How can I determine whether my configuration is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the known impact?

What can be done before upgrading?

How can I determine whether my configuration is affected?